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Abstract. For half a century, authors have weakened the rule of necessitation in 
various more or less ad hoc ways in order to make inconsistent systems consistent. More 
recently, necessitation was weakened in a systematic way, not for the purpose of resolving 
l_J ■ paradoxes but rather to salvage the deduction theorem for modal logic. We show how this 

systematic weakening can be applied to the older problem of paradox resolution. Four 
examples are given: a predicate symbol S4 consistent with arithmetic; a resolution of the 
surprise examination paradox; a resolution of Fitch's paradox; and finally, the construction 
of a knowing machine which knows its own code. We discuss a technique for possibly finding 
answers to a question of P. Egre and J. van Benthem. 



J> 1 §1. Introduction To make a certain system consistent, iMvhil] ( 1960h sug 



ON . gested (pp. 469-470) weakening the rule of necessitation to only range over arith- 

metical formulas. Since then, others have sugg ested var i ous o ther weakenings of 
necessitation to make other systems consistent. iHalbachl (l2008f) restricted necessi- 



tation to formulas not involving a particular predicate; lEgrg I2OO5I) hin ted (p. 44) 



O 
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The rule of global necessitation for a modal operator K is as follows: 

03 



at separating necessitation from soundness. Meanwhile, iFittina (|2007[ ) weakened 
necessitation in a different way, not to repai r inconsistencie s but i nstead to recover 
the deduction theorem for modal logic (see lHakli fc Negril (|2012T ) for a survey on 
this issue). Fitting's weakening has the advantage that it is very systematic. We 
apply it to the older objective of fixing inconsistencies. 



Suppose we have some axioms which are divided into global and local axioms. 
obal necessitation for a modal operator K is as follows: 

— 7— r- provided <fi has been proved without appeal to global axioms. 
K(4>) 

The rule of global necessitation for a predicate symbol K is the same, except that 
<fi/K((j>) is replaced by cf> / K ( r (fp) . The idea is that a global axiom is one which is 
thoroughly trusted by the agent whose knowledge (or belief or...) is represented by 
K, whereas a local axiom is true, but may not be known by the agent, or may be 
known with low conviction. 

Formally, if a system S consists of a set of global axioms, a set of local axioms, 
and the rule of global necessitation for K (and modus ponens, which we hereafter 
implicitly include in every system), we say S |= 4> if there is a sequence 4>\, . . . , 4> n 
such that (f> n is (f> and such that for every i, 

1. <pi is a local axiom, or 

2. ipi is a global axiom, or 

3. 4>i is logically valid, or 

4. 4>i follows from two earlier members of the sequence by modus ponens, or 

5. 4>i is K((f>j) (or K( r (j)j n ) if if is a predicate symbol) for some j < i such that 
for every 1 < k < j, <j>k is an instance of one of items (2)-(5) of this list. 
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For example, the system GLS of provability logic (jBoolod (|l993h p. 65) is equiv- 



alent to a system with global axioms the axioms of GL, local axiom schema T, and 
the rule of global necessitation. 

The idea for this weakened necessitation appeare d in Fitting! ( 20071 ) (p. 94) and 



more recently it was used by lHakli fc Negri ( 2012 ). In both cases it was simply 



called the rule of necessitation; we have called it the rule of global necessitation so 
as to distinguish it from its stronger ancestor. 

The follow ing lemma (compare the suggestion of Smorvnski ( 19841 ) (p. 454), as 



described bv lHakli fc Negril (|2012l) (p. 854)) is very useful for showing consistency 
of systems involving the rule of global necessitation. To state it succinctly, we adopt 
the following notation: if if is a modal operator, K[<fi] will denote K(<fi), and if K 
is a predicate symbol, K[(j>] will denote K( r (f>~ 1 ). 

Lemma 1.1. Assume a logic where the compactness theorem holds. Suppose S is 
a system consisting of a set S g of global axioms, a set Se of local axioms, and the 
rule of global necessitation for K . Let S' be the following system of axioms: 

1. (j), if(f)€S g . 

2. K[<j>\ if (f> is logically valid. 

3. K[(j) -> tp] -> K[4>] -> K[tp]. 

4. K[<p] if <p is an instance of (l)-(3) or (recursively) (4). 

5. <j), if <f> G Se. 

For any <p, if S (= cj>, then S' (= (f>. 

Proof. Let Sq be the system consisting of axioms S g and the rule of global 
necessitation. Let S' be the set of axioms from lines (l)-(4) of S'. We claim: For 
any <f>, if So \= <f> then S \= <f). This is proved by induction on proof length from 
Sq. The only interesting case is when cj) is K [(f>o\, where So \= <f>o in fewer steps. By 
induction, S' \= <po- By compactness, there are s%, . . . , s„ £ S' such that 

si ->• • • • ->• s„ -> <f>o 

is valid. By (2), 

S' \= K[si -> • • • -4 s n -> 4> }. 
By repeated applications of (3), 

S Q \=K[sx}^ ► K[s n ] ^K[<j> }. 

By (4), for each i, K[sj\ G S' , since each Sj G S' and S' is closed under K. Thus 
Sq \= K[cj>o\, as desired. 

Now we attack the main lemma itself, again by induction on proof length. Suppose 
S \= <f>. There is only one nontrivial case: <fi is K\4>o\ where S \= </>o in fewer steps 
and (f> is obtained from that shorter proof by the rule of global necessitation. Since 
4> is so obtained, this means every step in the proof of 0o is an instance of lines 
(2)-(5) of the definition of proof on the previous page. This implies Sq \= <Pq, and 
thus 5*0 (= K[cj)o], and so by the claim, S' |= K[<j) ], so certainly S' |= K[(f>o\. □ 



The bulk of the paper will concern modal operator paradoxes. The reason for 
this is that, due to self-reference, systems involving full necessitation for a predicate 
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symbo l blow up extremely easiljQ, and thus the well-known paradoxes (see Egre 



(2005)) tend to be low- level, by which I mean they usually derive contradiction from 
some set of assumptions which is (equivalent to) a tiny fragment of a predicate- 
symbol S'41- Thus, the following theorem more or less resolves them all in one fell 
swoop (and might, t herefore, be a tentative st ep toward resolving tensions described 
in sections 1 & 2 of lHalbach fc Welch! (|2009h ). 



Theorem 1.2. (A predicate symbol version of weakened 54, consistent with arith- 
metic) The following system is consistent (in the language of Peano Arithmetic 
extended by a predicate symbol K): 

1. (Global) The axioms of Peano Arithmetic. 

2. (Global) K( r (j) -> ^) -> K( r <jP) -> K{ r iP). 

3. (Global) K{ r <fi) ->• K( r K{ r ^y). 

4. (Local) K{ r <jP) -> (f>. 

5. The rule of global necessitation. 

(We'll discuss the philosophical plausibility of localizing soundness like this in 
the Conclusion.) 

Proof. Let S' be the following system: 

1. The axioms of Peano Arithmetic. 

2. K( r <j) -> V n ) -> #( r <£ n ) -> #( r V> n )- 

3. if( r n ) -> K{ r K{ r (Py). 

4. Jf ( r n ) whenever is valid. 

5. if ( r n ) whenever <f> is an instance of (l)-(4) or (recursively) (5). 

6. K ( r n ) ->■ 0. 

By Lemma H.1.1 we need only show S' is consistent. 

In the absense of non-modus ponens rules of inference, consistency is easy to 
prove: merely construct a model. Let S' consist of the axioms in lines (l)-(5) of 5". 
Let be the model which has universe N, which interprets symbols of PA in the 
intended ways, and which interprets K as follows: 

Jf h K{^<P) iff S' h 

(we do not care how JV interprets K(n) if n is not the Godel number of a formula). 
We will show that jV \= S', proving the theorem. 

Preliminary Claim: whenever S' |= (j), S' \= K(f~<fP). To see this, suppose S' \= <j). 
By compactness, there are s%, . . . , s„ 6 Sq such that 

si ->•••->• s n -> (f> 

is valid. It follows Sq \= K( r (jP) by an argument similar to the proof of Lemma fl. 1.1 
Armed with the claim, we show jY \= S' . Suppose cr € 5', we will show ,yV \= a . 



1 In lMontaguel (|1963| ) (p. 294) (also quoted in lEgrel ((2005)) we find: "...if necessity is to 
be treated syntactically ... then virtually all of modal logic, even the weak system SI, 
is to be sacrificed." 

2 One exception is the predicate symbol treatment of the surprise examination paradox, 
but that paradox h as an equally good moda l operator treatment anyway. Another 
exception appears in Horstcn & Lcitgeb (2001), more on that in our Conclusion below. 
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Case 1: a is an axiom of Peano Arithmetic. Then jV |= a because jV has universe 
N and interprets symbols of PA in their intended ways. 

Case 2: a is K{ r (j) -> V n ) K{ r <jP) -4 K{ r ^). Assume ^ |= -> V n ) 

and |= A( r n ). By definition this means S' (= — >■ ^ and 5q |= </>. By modus 
ponens, 5q |= ip, so ,yK |= i^( r -0~ l ), as desired. 

Case 3: a is if( r n ) -> A( r J ftT( r n ) n ). Assume jY \= K( r <P). This means S' \= 4>. 
By the preliminary claim, S' |= if( r n ), which shows t/f |= K ( r K ( r <fi~ l )~ l ) . 

Case 4: <r is K ( r (f>~ 1 ) where <f> is valid. Since tj> is valid, certainly Sq \= <j>, so 
JY h ^( r </> n ). 

Case 5: a is K( r <p n ) where is an instance of (l)-(5) of 5". Then <fr £ S' Q , so 
S£ ^ 0, so JV |= Kf</r). 

Case 6: c is if( r (/)~') — !> 0. Assume JV |= A'( r 0~ l ), which means Sp (= 0. Note 
that, by Cases 1-5, jY |= S' . Since ■yf |= S' Q and 5q |= 0, JY |= 0, completing the 
proof. □ 

Although we expressed Theorem ll.2.l as a result about knowledge, it could .just as 



well b e couched as a result about truth predicates (thickening the plot of lFriedman fe Sheard 
( 1987h ). 



§2. Myhill's Necessitation and a Moore's Paradox Mvhill (|l960h made 



a certain system consistent by forcing necessitation's premises to be arithmetical. 
This differs from our approach: Myhill's weak necessitation discriminates based on 
the form of the premise, whereas ours discriminates on the origin of the premise. In 
this section, we exhibit a paradox thwarting Myhill's method but repairable with 
global necessitation. 

Let 4' be a sentence (in the language of Peano arithmetic) which is true about N 
but independent of PA. For example 4' could be Con(PA) or 4" could be Goodstein's 
Theorem fsee iKirbv fc Parid (|l982l )). Thus the Peano arithmctist docs not know 



4", although 4f is true. 

We might, therefore, attempt to study arithmetists' knowledge using a system 
consisting of the axioms of PA, 4 1 , -iK( r ^>~ 1 ), and the rule of necessitation. Of course 
this would be very flawed (and provably inconsistent with a very short proof): 
the rule of necessitation should not be allowed to interact with 4< because the 
arithmctist does not know 4"! None of this is surprising, the only reason we bring it 
up is to point out that Myhill's weakening of necessitation, restricting it to purely 
arithmetical premises, has no effect here. On the other hand, the rule of global 
necessitation can be used to articulate the system properly. 

Theorem 2.3. The following system is consistent (K a predicate symbol): 

1. (Global) The axioms of Peano Arithmetic. 

2. (Local) 4». 

3. (Local) ^K{ r ^). 

4. The rule of global necessitation. 

Though the theorem may rightly be considered silly, the proof introduces a useful 
trick. 

Proof. By Lemma fl. 1.1 it suffices to show the following system S' is consistent: 
1. The axioms of Peano Arithmetic. 



ZU064-05-FPR int 5 October 2012 1:25 



Global Necessitation 5 

2. K( r <fP) whenever <j> is valid. 

3. if ( r -> V n ) -> ^( r ^ n ) ^( r V- n )- 

4. if ( r c/> n ) whenever is an instance of (l)-(4). 
5. 

6. -.if( r m). 

Let be the set of axioms in lines (l)-(4) of S'. Let jY be a model with universe 
N, interpreting symbols of PA in the intended ways, and interpreting knowledge so 
that 

,jV h if m iff S' h 0. 

We will show =yK |= S", proving the theorem. The tricky part is to show jY |= 
-,if (riin). p or tllat we need . 

Preliminary Claim: ^= 'J'. 

In the absense of non-modus ponens rules of inference, to show a theory does 
not prove a formula, it suffices to build a model of the theory where the formula is 
untrue. Here, it suffices to build a model of S' where iff is untrue. 

Since iff is independent of PA, there is a (nonstandard) model in the language 
of PA, such that |= PA and Ji |= -Jft. We will extend ^ to a model in 
the language of PA plus if. To do so we must specify how Jt' is to interpret if. 
Let Ji' interpret if so that 

J(' \= K( r (f)~ 1 ) for every <j> 

(loosely: J£' "knows everything"). I claim Jt' \= S' . To see this, let r G 5q, we 
will show |= r. 

Case 1: r is an axiom of PA. Then Ji' |= r since ^# |= r and agrees with 

on the language of PA. 
Case 2: r is if ( r c6 n ) where is valid. Then |= if ( r c6 n ) since knows 
everything. 

Case 3: r is if ( r cA -)• V n ) -> if ( r n ) -»• if ( r ^ n ). We have ^T' |= if ( r 7/P) since 
knows everything. 

Case 4: r is if ( r n ) where c/> is an instance of (l)-(4). Then Ji' \= K{ r (jP) since 
J£' knows everything. 

Thus Jt 1 \= Sq. And Jt' \fc if> since Ji \fc if> and Jt' agrees with Jt on the 
language of PA. This proves the preliminary claim (in fact by arbitrariness of iff it 
proves S' is a conservative extension of PA) . 

For the theorem itself, let a e S', I claim ,yV \= a. 

Case 1: a is an axiom of Pcano Arithmetic. Then jV (= cr since jY extends N. 

Case 2: a is if ( r n ) where <j> is valid. Since is valid, Sq \= </>, thus J/ \= K{ r (jP). 

Case 3: a is if ( r -> ip n ) -> if ( r cA n ) — > if ( r ^ n ). Assume ^ |= if ( r </> -> 7/> n ) and 
i/f |= if ( r </> n ). That means Sq \= <f> — > ?/> and 5 |= 0. By modus ponens, Sq |= V, 
so |= if ( r ^ n ). 

Case 4: cr is if ( r c/> n ) where <j) is an instance of (l)-(4). Then <f) G Sq, hence Sq |= 
and |= if ( r cA n ). 

Case 5: cr is iff. We have |= iff since =yf extends N. 

Case 6: a is -.if ( r * n ). By the Preliminary Claim, S ^ f. Thus ^ ^ if ( r f n ), 
as desired, proving the theorem. □ 

Whenever we establish a consistency result by localizing certain schemas, a 
natural question is what is the minimum set of schemas we can localize and obtain 
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consistency. It is clear that we cannot strengthen Theorem 12.3.1 by globalizing 
And by Lob's Theorem it follows we cannot globalize -^K( r $>~ 1 ) either, so in some 
sense Theorem 12.3.1 is sharp. Remarkably, though, the same system, formulated 
using a modal operator instead of a predicate symbol, can be further sharpened. 

Theorem 2.4. The following system is consistent (K a modal operator): 

1. (Global) The axioms of Peano Arithmetic. 

2. (Local) 

3. (Global) -.#(#). 

4. The rule of global necessitation. 

To prove the theorem, we need a technical lemma which we'll use again later. 

Lemma 2.5. Suppose K is a modal operator, S is a set of axioms, and K(S) (the 
K -closure of S) is the set of axioms 

1. 4>, if<t>eS. 

2. K((ft) f if <j) is an instance of (1) or (recursively) (2). 

Suppose jY is a model in which K is interpreted so that ,jV |= K{</>) iff ,JY |= <j>. If 
JV \= S then jY |= K(S). 

Proof. Assume jV |= S. We prove by induction on formula complexity that for all 

4> e K(S), .jY h <P- 

Case 1: <f> is of the form K(<po) for some 4>o- If </> 6 5* we are done. If ^ S, then 
<j) is an instance of line (2) of K(S), and thus <j)o £ By induction, jf \= c/>o, 

and thus Jf |= K((f> Q ). 

Case 2: <f> is not of the form K((/>q). Then </> must be an instance of line (1) of 
K(S), i.e., <f) £ S, and <yK |= <fi by assumption. □ 

Like Theorem 12.3.1 the proof of Theorem 12.4.1 introduces a trick which we'll use 
again later. 

Proof of Theorem \2.4-\ By Lemma 11.1. 1 it suffices to show the following system 
S" is consistent: 

1. The axioms of Peano Arithmetic. 

2. -,#(*). 

3. K{4>) whenever <p is valid. 

4. K((f> -> ip) ->■ if (0) A(V>). 

5. whenever is an instance of (l)-(5). 
6. 

Let Sq consist of lines (l)-(5). Let jY be a model with universe N, interpreting 
symbols of PA in the intended ways, and interpreting K so that 

jV h K{<i>) iff S' h 0- 

We'll show jY |= S", proving the theorem. As before, the tricky part is showing 
,yV \= -iA('I'). For that we'll need the same preliminary claim as before, but now 
with a different proof. 
Preliminary Claim: S' ^= 

To prove 5q ^ * it's enough to build a model of Sp where * fails. Since PA y= 
there is a (nonstandard) model ^# (in the language of PA) such that ^# |= PA and 
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^ Y= ^> . Extend .4% to a model in the language of PA plus K, by recursively 
letting 

J(> |= K{<f>) iff Jf.' |= 4> 

for every formula (f> (this would, of course, be impossible if K were a predicate 
symbol). I claim \= S' Q . To see this, let r € S' , we'll show |= r. 

Case 1: r is an axiom of PA. Then |= r since ^# ^= r and agrees with 
^# on the language of PA. 

Case 2: t is -.if By definition, J(' \= Ki^l) iff Jt' \= And ^ * since 
^ \p and they agree on the language of PA. So |= -^K(^). 

Case 3: t is K(<j>) where <f> is valid. Since cf> is valid, |= <f), thus |= K (</>). 

Case 4: t is K(<f> ->• ^) -> /£"(</>) -> if(V'). Assume |= -> V) and |= 
K{<j>). This means |= (j> -> V and |= 0. Thus ^ ^, so (= K(ip). 

Case 5: r is K(cf>) where <j> is an instance of (l)-(5). Then \= r by Lemma f2. 5. 1 

This establishes \= S$. And ./#' ^= '5, since ^= 4" and the two agree on 
the language of PA, therefore S' \/= ^> and the claim is proved. 

Now back to the main theorem, for a 6 S', we must show jV |= er. This splits 
the proof into the same six cases as Theorem 12. 3. i and the six cases are proved in 
exactly the same ways as in Theorem 1 2. 3. [ so we omit them. The crucial difference 
was the different proof of the Preliminary Claim. □ 

This has an interesting informal application to non-idealized epistemology. As a 
mathematician, I would like to be able to state the following Moore's paradox: 

• Peano Arithmetic (or ZFC) is true, 

• The Four-Color Theorem is true (I trust Appel fc Haken ( 19771 )). 



• I do not know that the Four-Color Theorem is true (I have utmost confidence 
1 will not discover a proof of it in my lifetime), 

and operate using the rule of global necessitation (-iK(4CT) being global, and ACT 
being local). Strictly speaking, this is inconsistent; but we won't obtain contradic- 
tion through purely epistemological means, as the system would be consistent if 
ACT were independent. I believe I can w ork in this system my whole life and not 
state a contradiction. See lShapirol ( 2012h p. 7 for a similar example. 



The proofs of Theorems 12.3.1 & 12.4.1 highlight a difference between operators and 
predicates: with operators, we can prove ^= by constructing toy models where the 
operator is interpreted as truth, which is impossible with predicates. 



§3. Example: The Surprise Examination Paradox The surpri s e exa mi- 
nation paradox hardly needs an introduction (but the sur vey by IChowl dl998l) is 



worth y of pleasure-reading). For a formalization, we turn to iMcLelland fc Chihara 
(1975), where we find the following system laid out on pp. 76-77 (the language is 
prepositional, with atoms pi, . . . ,p n , where n is the number of days in the week 
and pi is read as "the examination takes place on the ith day" , further extended 
by a modal operator K, with K((f) read as u <f> is known just prior to the exam"): 

1. K(4>) ->• cj). 

2. K(<j> ->• if>) -> K{4>) -> K(tp). 

3. T n , by which is meant p\ V • • • V p n ("an exam will occur"). 

4. /\™ =1 -i-K"(pi) ("it will be a surprise"). 
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5 - A"=i((" ,T i) -> K h T i))> wh ere T t abbreviates p x V • • • V Pi (" exam non- 
occurrences are observable" ) . 
6. The rule of necessitation. 

The above system is inconsistent, due to the surprise examination paradox. We 
would like to make it consistent by weakening necessitation. Following the example 
in Section 1 in which we made 5*4 consistent for predicate symbols by localizing 
soundness, we might attempt to resolve the surprise examination paradox in the 
same way. But it is not difficult to see that the above system remains inconsistent 
even with K(<f>) —> <fi localized and necessitation replaced by global necessitation (in 
fact, the system remains inconsistent even if the K{4>) — > (f> schema is completely 
removed) . 

It is possible to show the system becomes consistent if we localize both K(<f>) — > 4> 
and /\™=i^K(Pi)- This is unsatisfactory, though, because to localize the latter 
axiom is to suggest the students ignored the "surprise" part of th e surprise examina- 



tion a nnouncement or didn't take it very seriously. Fortunately, iKritchman fc Raz 
come to our rescue. When McLelland and Chihara laid down their for- 
mulation of the paradox, they did so with the understanding that an event is 
surprising precisely if it is unknown just prior to its occurrence. Kritchman and 
Raz point out that, under this definition of surprise, an inconsistent knower is never 
su rprised, since an inconsis tent knower knows everything (the same was observed 
bv lHalp ern fc Mosesl ()l986f ) some time earlier) . It seems that if I know everything 



(including contradictions), that's as bad as knowing nothing whatsoever. Therefore, 
we should admit a different definition of surprise: 

An event is surprising if either 1) it is unknown just prior to its 
occurrence, or 2) a contradiction is known. 

We know (locally) that the students in the surprise exam paradox are sound, so to 
us, the two definitions of surprise are equivalent. But the students do not necessarily 
know as much. Based on this, the axiom /\™ =1 ->K(pi) should be weakened to 
(Ar=i ^KiPi)) V -^(-L) where _L is some contradiction (such as p\ A ~^p\). Having 
done so, we can keep it global, obtaining a more satisfactory resolution to the 
paradox. 

Theorem 3.6. Assume n > 1. The following system is consistent: 

1. (Local) K{<j)) -> <j). 

2. (Global) K((j) if)) -> K((f>) -> K{ip). 

3. (Global) T n , by which is meant pi V • • • Vp n . 

4. (Global) (/\J =1 ^Kfa)) V K{±). 

5. (Global) A™=i(( - '-^) — K(-iTi)), where Ti abbreviates p± V • • • Vft. 

6. The rule of global necessitation. 

Proof. By Lemma 11.1.1 it suffices to prove consistency of the following system S' : 

1. K{4> -> V) -> K((jj) -> K(i>). 

2. T n , by which is meant p% V • • • V p n . 

4. Ar=i((" ,T *) K (^ T *))> wher e T t abbreviates p x V ■ • • Vp*. 

5. K{4>) whenever <p is valid. 

6. K{4>) whenever <fr is an instance of (l)-(6). 
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7. K(4>) <j). 

Let Sq consist of the first six lines of S' . Let JV be a model where p\ is true, Pi is 
false for i > 1, and if is interpreted so that 

^ h # W iff ^ h 0- 

We will show ^/f |= S', proving the theorem. To do that, we need a preliminary 
claim. 

Preliminary Claim: For any 1 < i < n, S ^ pi. 

Fix 1 < i < n. Since S involves no non-modus ponens rules, it suffices to build 
a model of S' where pi fails. Since n > 1, there is some 1 < j < n such that j ^ z. 
Let be the model where is true, pu is false for all k ^ j, and knowledge is 
interpreted so that 

^# ^= if (</>) for every 0, 

i.e., ^# knows everything. I claim ^# |= S . Since ^# ^ p^, this will prove the 
preliminary claim. To see ^ \= S' , let r € S'q, we'll show |= r. 

Case 1: r is if(</> ->• -0) -> if(</>) ->■ K(ip). Well, ^# |= if(V0 since ^# knows 
everything. 

Case 2: t is T n . Then ^# ^= r since y$ \= pj. 

Case 3: r is (/\™ =1 ">if (Pi)) V if (_L). Then ^ (= r since .# |= if (J_). 

Case 4: r is ALi((^ T -> K h T *))- lt suffices to show ^ (= if(-T fe ) for an 
arbitrary 1 < k < n. This is true because ^# knows everything. 

Case 5/6: r is if(</>) where (j> is valid or <f> is an instance of (l)-(6). Then ^# ^= 
if ((f)) since ^# knows everything. 

This shows ^ \= S' , and so since ^# ^ pi, Sq ^ Pi- The Preliminary Claim is 
proved. 

Back to the main theorem, to show JV |= S' , let a € 5", we'll show jV |= cr. 
Case 1: cr is if(0 ->■ ->■ if(0) ->■ if(V>)- Suppose =yf |= if(</> -> V) and 
JY |= if (». This means S |= ^ -> V and S'q |= 0. Thus S' \= ip and J( \= K(ip). 
Case 2: cr is T„. Then <yK (= cr since I yK ^ p\. 

Case 3: cr is (A™=i _1 -^'(P*)) V if (-L). To show <yK |= cr it suffices to let 1 < i < n 
be arbitrary and show |= ->if (pi). By the Preliminary Claim, S' Pi, thus 
jV y= K(pi), as desired. 

Case 4: cr is ALi((~ /r ^ K h T i))- Then h CT vacuously, because!^ ^ 
for any i, because |= p±. 

Case 5: cr is if ((f) where c6 is valid. Since cf> is valid, S Q \= <fr, so ^/f \= K((f>). 

Case 6: cr is if ((f) where (/> is an instance of (l)-(6). Then (fj e S'q, so S \= <j>, so 

Case 7: cr is if ((f)) — > 0. Suppose <yf ^ K((f). This means S ^ By Cases 1-6, 
</f |= S . Since ^/f |= S' and S |= (j), JV and our work is finished. □ 



3 This technique fails if we want to make pi false in ^V, i.e. if we want the surprise 
examination to fall on a day other than Monday. The proof can be altered, at the price 
of slightly more complexity, to allow a surprise exam on any day except for day n. For 
a surprise exam on day 1 < k < n, one would add -^Tk-i as a global axiom to the 
system and adjust the proof accordingly, and in the proof of the Preliminary Claim, 
choose j > k. 
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§4. Example: Fitch's Paradox Fitch's Paradox, first published in lFitchl ([19631 ) 

is the fact that under certai n assumptions , if every true fact is knowable then 
every true fact is known. See ISalernol (|2010T ) for an introduction, tho ugh we part 
ways when it comes to the exact system to us^]. Instead we turn to ICosta-Leitd 
( 2006) who obtained the following system by very systematic means (the language 



is propositional, extended by modal operators K and □, and (if we understand 
correctly) o abbreviates -O-i): 

1. u{4> -». -+ -+ □ W). 

2. (K(<f> -> 4>) A K{(j>)) -> K(ijj). 

3. K(4>) -> <f>. 

4. The knowability thesis: (f> — > o{K {()>)). 

5. D-necessitation: <f>/\3(<f>). 

6. if-necessitation: <fi/K(<fi). 

From these, the omniscience principle schema, cj> — > K(cj>), can be deduced by what 
is known as the Church-Fitch argument. This is considered a paradox since it seems 
plausible that all truths are knowable (4> — > o(K (</)))) but it seems absurd that we 
are omniscient. We would like to weaken necessitation to remove this unwanted 
consequence. It turns out that if we localize K(<fi) — > 4>, it resolves the paradox so 
strongly, we can even strengthen the knowability thesis. 

Theorem 4.7. Let Jzf be a propositional language (with at least one atom q) 
extended by modal operators K and □. Let S be the following system in Jzf : 

1. (Global) D((f> ->• tp) -> (□(</>) -> n(ip)). 

2. (Global) (K(<P ->• i>) A K ((/>)) -> if(^). 

3. fLocaZj -> 0. 

4. (Global) The strong knowability thesis: o(K(<f>)). 

5. The rule of global necessitation for □. 

6. The rule of global necessitation for K . 

Then Sy=q^ K(q). 

Proof. By a straightforward variation of Lemma 11.1.1 it suffices to show S' ^= q — > 
K(q), where 5" is: 

1. D(<f> -». V) -> (□(</») -> □ (*/>)). 

2. (Jf(0 ->• V-) A -> tf(V0- 

3. The strong knowability thesis: o(K(4>)). 

4. K{4>) whenever <fi is valid. 

5. □(</>) whenever </> is valid. 

6. !£"(</>) whenever <f> is an instance of (l)-(7). 

7. □ (</>) whenever <f> is an instance of (l)-(7). 

8. K[(f) -> </>. 



4 I should confess here that in I Alexander! (jpreprintf) I committed a grave sin: I misread 
Salerno's system and attributed a different system to him for which he was not 
responsible. 
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Let S' consist of lines (l)-(7) of S' and let JV be a model in which q is true and if 
and □ are interpreted so 

jV |= K{4>) iff S'q h <P, and JT |= □(<£) iff ^ h 

(we admit this is a very unusual semantics for □, but since the theorem we are 
proving is entirely syntactical, that should not matter). We will show JV |= S' and 
,jV Y= q if (<?). Since S' involves no non-modus ponens rules of inference, this 
will show S' y= q — >• K(q) and prove the theorem. 

Preliminary Claim: There is a model jft such that jffl |= S' Q) \£ q, and 
^ Y= ~^K((j)) for every formula <f>. 

Let „# be a model in which q is false, if is interpreted so that 

^# |= if (0) for every <j>, 

and □ is interpreted recursively so that 

M (= □((/.) iff ^ (= </>. 

Right away ^# \£ g and ^ ^= ->K ((/>), it remains to show |= S'q. Let r 6 5J, we 
will show |= r. 

Case 1: r is □ (</> — ^ -0) (^(0) — > □(■0))- The way ^ interprets □, to show 
^ ^rwe must show ^ \= (<fr ip) —> (<f> —> i/j) , but this is a tautology. 

Case 2: r is (K(<f> ip) A if (0)) -> if (0). Then ^ (= r because ^ (= if (0). 

Case 3: r is o(K(<f)). Unwrapping the abbreviation, r is -0(-iif (0)). By the way 
interprets □, we must show ^ |= -i(-iif (</>)), i.e. ./# (= if (</>), which is true by 
the way ^ interprets if. 

Case 4/5: r is K{4>) or □(</>), where is valid. Trivial. 

Case 6: r is if (<fi) where (f> is an instance of (l)-(7). Trivial. 

Case 7: r is □(</>) where is an instance of (l)-(7). Then |= r by Lemma f2. 5.1 

This shows ^# (= S and proves the Preliminary Claim. 

Back to the main theorem, we have two things to show: that jY Y= q — > K(q), and 
that ,jV |= S'. Since JV \= q, to show jY Y= q — >• if (g) we must show o/K ^ if(s), 
i.e., that S'q ^= g. But this is true by the Preliminary Claim: there is a model where 
S' holds and q fails. 

To show Jf |= S', let a e S', we will show ^ |= S'. 

Case 1/2: cr is n(<f> -> 0) -> (□(<£) -> D(0)) or (if (0 -> 0) A if (0)) -> if (0). By 
now, this case should be straightforward. 

Case 3: a is o(K((f>)). That is, a is -0(-iif (0)). By the Preliminary Claim, there 
is a structure where S'q holds and — iif (0) fails. Since there are no non-modus ponens 
rules of inference in Sq, this shows Sq Y= -iK((j>). Thus jY Y= D(-iif (<p)), as desired. 

Case 4/5: a is if (4>) or □ (</>), where <\> is valid. Trivial. 

Case 6/7: u is if (0) or □(</>), where is an instance of (l)-(7). Then <f> G Sq, thus 
S h 0, thus ^ |= if ((f>) A □(</>). 

Case 8: a is if (0) — » 0. Suppose <yK |= if (</>), which means Sq |= <f>. By Cases 
1-7, \= S' . Thus ^ |= 0. This proves the theorem. □ 

The ab ove theorem is strictly stronger than the second theorem of lAlexander 



(jpreprintf ) . in which the knowability thesis was also localized along with if (</>) —> <f). 

To prove Theorem 14.7.1 we constructed a model in which if and □ were inter- 
preted identically. Thus we could strengthen Theorem 14 .7. 1 by adding if (<j>) <H» D(0) 
as a local axiom (call it if = □). Could we add this axiom globally? The answer 
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turns out to be "no" ; one can see this by using the variation on the Church-Fitch 



argument which I published in I Alexander! (|2012j) . It is, however, possible to globalize 



K = □ and avoid paradox if, in exchange, the knowability thesis is localized: 
Theorem 4.8. The following system does not prove q — > K(q): 

1. (Global) □(> V) -> (□(</>) -> □(»)• 

2. (Global) (K(<f> -4 V>) A -4 K(^). 

3. ('G/oba/) isT(0) O □(</>). 

4. fLocaZj if (0) ->• 0. 

5. (Local) The strong knowability thesis: o{K {<)))). 

6. The rule of global necessitation for □. 

7. 27ie rule of global necessitation for K . 

Proof Sketch. Similar to the proof of Theorem 14. 7 4 with S' and Sq modified in the 
obvious ways. The crucial difference is the proof of the Preliminary Claim. When 
constructing the model j$ of the Preliminary Claim, make it interpret K and □ 
so that 

J( \= K{4>) for all 0, and Jf, |= □ (</>) for all 0. 

Note that ^# will then fail the knowability thesis- but that is fine, since the 
knowability thesis is no longer in S' - but satisfy K{<j>) □ (</>). □ 

In summary we can say the following about the structure of Fitch's paradox (G 
stands for global, L stands for local): 

• G-Soundness + L-Knowability |= Paradox (Fitch ( 19631 )). 



i-Soundncss + G-Knowability ^= Parado x (Theoreml4.7.l) . 



G-Knowability + G-{K = □) (= Paradox ({Alexand er (2012)). 



• G-(K = □) + L-Knowability + L-Soundess ^ Paradox (Theorem WK\f . 
In Halbachl ( 20081 ) we were asked, "What if the preferred remedy for the paradox 



of the Knower and other paradoxes of self-reference also helps to resolve Fitch's 
paradox?" In light of Theorems 11.2.1 and 14.7.1 it seems we've achieved precisely that, 
at least if preferred is read as "preferred by the present author" . 



§5. Example: Machines which know their own codes It is considered a 
well-known fact that if a mechanical knowing agent is capable of logic and arithmetic 
and self-reflection, t hen th a t mac h ine cannot k now t h e index of a Turing machine 
repres e nting it. See Lucas! ( 1961 ). Benacerral (1967), Reinhardt ( 1985a ). Penrose! 
19891) . ICarlsonl (l2000h . and TPutnaml (|2006f. However, the proofs involve unre- 



stricted necessitation in various guises. We will weaken necessitation and explicitly 
construct a machine which knows its own code. 

Following[Carlson| (|2000h . we work in the language of Peano Arithmetic e xtended 
by a modal operator K (i.e., the language of Epistemic Arithmetic of [Shapiro 
(1988)). For de re semantics we use Carlson's base logic. To paraphrase and sum- 
marize: a structure for a modal language consists of a first-order structure ,jV for 



5 Putnam does not speak so much about arbitrary machines which know their own code, 
but rather argues that the totality of scientific knowledge is not a machine which knows 
its own code. 
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its first-order part, together with a function which takes a purely modal formula 
K((ft) and a variable assignment s and outputs True or False- in which case we write 
JY \= K((j))[s] or jV Y= K{(f))[s\ respectively- satisfying some technical conditions 
which we will here brush under the rug. 

If is a formula with free variables x\, . . . , x n (and no others), a universal closure 
of cf> is Viei • • • \/x n 4>. To prove that a given model jV satisfies a universal closure of 
cj>, it suffices to le t s be an arbit rary assignment and show ,yV |= 4>[s]. 

It follows from ICarlsonl ( 20001 ) (specifically from Proposition 3.2, Definitions 3.1 



and 3.4, and the discussion on p. 54) that the following system is inconsistent (this 
can be glossed as "a machine cannot know its own code" ) : 

1. 54, by which is meant 

(a) Universal closures of K(<fi — > ip) — > K((f>) — ) K(ip). 

(b) Universal closures of K(<fi) — > <f>. 

(c) Universal closures of K (</>) — > K(K(<fi)). 

(d) The rule of necessitation. 

2. The axioms of Epistemic Arithmetic (i.e., Peano Arithmetic, with the induc- 
tion schema extended to our modal language). 

3. (Knowledge of Code) 3eK(\/x(K(<fi) <h> x G W e )), when x is the lone free 
variable of </>. 

• Here W e is the eth r.e. set and x G W e abbreviates a formula stating 
that x lies therein. 

We will localize (lb) and show the resulting system is w-consistent by explicitly 
constructing a machine which knows its own code (via Kleene's Recursion The- 
orem). Our m achin e construction method is somewhat similar to the method of 
Carlson (|2000h and lCarlsonl (|2012l) . Whereas my goal is a truthful machine which 



knows its own code at the cost of its own truth, Carlson's goal was a truthful 
machine which knew its own truth and knew it had some code, articulated by 
Reinhardt's Strong Mechanistic Thesis: K(3e\fx(K(4>) o x g Wz))- To do this 
Carlson used a very careful analysis of ordinal arithm etic ( Carlson! ( 1999h ) . later 



organized into patterns of resemblance in lCarlsonl The reason Carlson's goal 



took so much work was precisely because his machines knew their own truthfulness 
globally; by localizing that, we'll have much less difficulty reaching our own goal. 
For every n 6 N, let S n be the following system: 

1. Weakened SA, by which is meant 

(a) (Global) Universal closures of K(<f> ip) K((f)) -> K(ip). 

(b) (Local) Universal closures of K((j)) — > (f>. 

(c) (Global) Universal closures of K{<j>) -> K(K(cf>)). 

(d) The rule of global necessitation. 

2. (Global) The axioms of Epistemic Arithmetic (i.e., Peano Arithmetic, with 
induction extended to the modal language). 

3. (Global) (Having Code n) \/x(K((f>) <H> (x : r (fP) S Wn), provided x is the lone 
free variable in <fi. 

• Here (x, r (fP) G Wn abbreviates a formula saying (x, gn(<f))) G W n where 
gn(4>) is the Godel number of <j> and (•, •) : N 2 — > N is a canonical 
computable pairing function. 
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My goal is to show that there is some n G N such that S n is w-consistent. 
Assuming I can do that much, we can combine global necessitation with (3) to see 

S n h K(Vx(K(4>) o (x, r<p) g W n )), 

which implies S n \= 3eK(yx(K(<f>) o x G W e )). 

With Lemma H. 1.1 in mind, for each n G N, let S' n be the system 

1. Universal closures of K (0 —>?/;)—> K(<fi) — > K(iji). 

2. Universal closures of K (</>) — > K(K(<fi)). 

3. The axioms of Epistemic Arithmetic. 

4. Mx{K{4>) o (x, r <ft~ l ) G Wn) (x the lone free variable of <ft). 

5. Universal closures of K{(j)) whenever <f> is valid (true in every structure ac- 
cording to the base logic). 

6. K(<f) whenever is an instance of (l)-(6). 

7. Universal closures of K(<f) — > <\>. 

Lemma 5.9. For each n GN, and each sentence 4>, if S n \= <fi, then S' n |= <p. 

Proof. Similar to the proof of Lemma Tl. 1.1 (Carlson points out that the base logic 
satisfies the compactness theorem). □ 

Thus, we only need show that S' n is w-consistent for some n G N. 
If (f> is a formula and s is an assigment, let 4> s denote the sentence 

(f>(x 1 \s{x 1 ))(x 2 \s(x 2 )) ■ ■ ■ 

obtained by replacing every free variable in (j) by the numeral for its s- value. 
For every n G N, let S' n0 be the following set of axioms: 

1. Lines (l)-(6) of S' n . 

2. (Assigned Validity) s , for valid <fi and s an assignment. 

3. K((f) for each instance of (l)-(3) of S^ - 

Lemma 5.10. There is a total computable function f : N — >• N such that for every 
n e N, 

H^(„) = {(m, gn(4>)) GN : 4> is a formula with FV(4>) C {x} and S' n0 \= <fi(x\m)} 

where <j)(x\rn) is the result of substituting the numeral rn for x in <j). 

Proof. By the Church- Turing Thesis (Carlson points out that the base logic satisfies 
the completeness theorem; combined with compactness, this implies that the set of 
consequences of each r.e. theory is r.e., and the code of the set of consequences of 
a theory depends uniformly computably on the code of the theory). □ 

Corollary 5.11. There is an n G N such that 
W n = {{m, gn((j))) <eN : 4> is a formula with FV((j>) C {x} and S' nQ \= 4>(x\rn)}. 
Proof. By Kleene's Recursion Theorem and Lemma T5. 10. 1 □ 



Theorem 5.12. Letn be as in Corollaru \5.11.\ Then S n is (J- consistent. In other 
words, there is a knowing machine which knows that it has code n. 
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Proof. As discussed above, it suffices to show S' n is cj-consistent. Let JV be a struc- 
ture, in the language of Epistemic Arithmetic, with universe N, which interprets 
symbols of PA in the intended ways, and which interprets knowledge according to 

jr^K{4>)[ s ] iffs; l0 M s - 

We will show that JV \= S' n . First we need a couple preliminary claims. 

Claim 1: For each formula <p and assignment s, JV |= 4>[s] iff JV \= <j> s . 

By induction on formula complexity. The only interesting case is when (f> is K((f> ). 
If JV |= K((j)o)[s], by definition this means S' n0 \= </>§. Since 0g is a sentence, for 
every assignment t we have (</>o)* = and thus S' n0 (= (4>qY- This shows that for 
every such t, JV \= By arbitrariness oft, this shows JV \= K(<Pq). Clearly 

K(4>1) = K((f)o) s . The reverse direction- that if JV |= K (4> ) s then JV |= ^(</. )[s]- 
is similar. 

Claim 2: For each sentence <p, if S' n0 \= <f>, then S^q |= K((f>). 

By compactness, if S' n0 |= 0, there are tri, . . . , erg e S^ such that 

(ii — > ■■•—>• cr^ — > <f> 

is valid. By (5) of S' n , 

S'nO H ^(^1 -> ► O-/ -> </>)• 

By repeated application of (1) of S' n , 

Since each Uj e S^Oi each K(pi) <E S^ since S^ is closed under if. By modus 
ponens, S' n0 H ^(0)> as desired. 

Armed with these claims, we are ready to show =yK |= S 1 ^. Let cr G S^, we will 
show t/K |= cr. 

Case 1: cr is a universal closure of K(<p —> ip) — > K((f>) — > K(ip). Let s be 
an assignment and assume JV |= K(<p — > ip)[s] and JV |= if(0)[s]. This means 
^nO H ~ ^ an( i ^no H Clearly ((f) — > f/;) s = s — > so by modus ponens, 
S'no \=ip s ,so JY \= K(ip)[s] as desired. 

Case 2: cr is a universal closure of K{4>) — > K(K(<f))). To get JV \= a, let s be 
an arbitrary assignment and assume JV \= K(<fi)[s}. This means S' n0 |= <p s . By 
Claim 2, S' n0 \= K((f> s ), and clearly K((j) s ) = K{<P) S , so S' n0 \= K{<i>) s . This shows 
JV \= K(K(<f>))[s], as desired. 

Case 3: a is an axiom of Epistemic Arithmetic. If cr is a basic axiom (such as 
Vx(S(x) ^ 0) or Mxiy(x ■ S(y) = x ■ y + x)), then JV \= a simply because JV has 
universe N and interprets symbols of PA in the intended ways. But suppose a is a 
universal closure of an instance 

<f>(x\0) -»• (Vx(<j> -> -> Vx0 

of the induction schema (<j> is allowed to involve K). Let s be an assignment and 
assume JV \= <f>(x\0)[s] and JV |= Mx(4> — > <j)(x\S(x)))[s]. We must show JV \= 
Vx<j>[s}. 

Since JV \= <f>(x\0)[s], it follows by Claim 1 that JV |= 0(a;|O) s . Clearly 0(a;|O) s = 
s ( a; |o) ; w here s(s|0) is the assignment which agrees with s except that it maps x 
to 0. So JV h ^ (a:|0) . 

For each m <G N, since o/f |= Va;(0 — > (/>(x|S(x)))[s], in particular JV |= — > 
0(x\S(x))[s(x\m)}. And thus i/ JV \= <j>[s(x\m)], then |= <j>(x\S(x))[s(x\m)]. 
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By Claim 1, that last sentence can be rephrased: if jY \= (p s ( x \ m \ then jY \= 
cj>{x\S{x)) s{x \ m) ; but clearly <j>(x\S , (x)) s ^ m) = ^l"^ 1 ), ao in summary so far: 

• For each m G N, if JV \= s Ol ro ), then JY (= 0«OI™+1). 

Therefore, by mathematical induction, JY \= <f> s{ ~ x \ m ) for every m G N. This shows 
(via Claim 1) that for every m G N, t/f |= 0[s(a:|m)]. This means precisely that 
|= Vx0[s], as desired. 
Case 4: er is Mx(K{4>) O (x, r <fp) G W^), where a; is the lone free variable in 0. 
To show |= (7 it suffices to let m G N be arbitrary and prove JY |= K((j>) 
(a;, r n ) € W^[s] where s is an assignment with s(x) = m. The following are 
equivalent: 

JT \= K{4>)[a] 

S' n0 \= <j) s (Definition of JY) 

S' n0 (= 4>{x\rn) (Since <f> has lone free variable x) 

(m,gn((f))) £ W n (By choice of n (Corollary 15. 11. [) ) 

|= (m, r 0~') G WW (Since <yf has standard first-order part) 
JY h {(x, r <P) € W^) 8 (Since s(x) = m) 

,yK h (a, r n ) S W^s], (By Claim 1) 

as desired. 

Case 5: a is a universal closure of K((f) where <f> is valid. Let s be any assignment. 
Since <j> is valid, tp s is an instance of the Assigned Validity schema from the definition 
of S' n0 . Thus S' n0 \= (f> s , hence JY \= K(<f>)[s]. 

Case 6: a is K (<f>) where 4> is an instance of (l)-(6) of S' n . Then <j> is a sentence 
(note: this is where we finally reap our reward for putting all those universal closures 
everywhere). So for any assignment s, <f> = <f> s , and so, since (l)-(6) of S' n are 
included in S' n0 , S' n0 (= s , whence JY \= (p[s\. 

Case 7: <r is a universal closure of i^(</>) — > 4>. Let s be an assignment and assume 
JY h K(<f>)[s] (so |= s ); we must show JY \= cf>[s]. 

First I claim that JY |= S^ . To see this, let r G S' n0 , we'll show «/f (= r. 

Subcase 1: r is an instance of (l)-(6) of S^. Then ,/f |= r by Cases 1-6. 

Subcase 2: r is V where "0 is valid and i is an assignment. Since ip is valid, 
,yK h #]• % Claim 1, f= ipK 

Subcase 3: r is K(ip) where ip is an instance of (l)-(3) of S' n0 . Similar to Case 6 
above. 

This shows JY |= S' n0 . Since ^ |= S; o and S' n0 \= (p s , ^ |= s . By Claim 1, 
.yf |= 0[s], as desired. The theorem is proved. □ 

What this section has established is that there is a certain dichotomy in machine 
knowledge: 

A truthful machine can know its own code, or it can know its own 
truthfulness, but not both. 

In future work we will explore formulations of Theorem 15.12.1 in which K is a 
predicate symbol rather than a modal operator. By localizing soundness, we rule 
out the self-referential paradoxes which would normally make predicate symbols 
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unimaginable in this role. See Halbach fc Welch (l2009h for a discussion of the 
relative merits of operators vs. predicates. 



§6. On a question of Egre and van Benthem At the end of lEgrel (2005), 
the following question appears (attributed to J. van Benthem): 

"...from what we saw, schematic Lob's theorem appears as the 
positive counterpart of a negative result ... Could there be other 
Lob-style strengthenings of the inconsistency results we have pre- 
sented, that provide us with positive information about consistent 
subsystems of the conflicting schemata?" 

Imagine we did not know Lob's theorem. One way we might find it is as follows. In 
Theorem 1 1.2. 1 we proved consistency of a weak predicate form of 54, by constructing 
a specific model. To probe for things that can be consistently added to the system, 
rather than consider the class of all models of the system (which is very hard to 
get our hands on) , we now have a particular model. Any schema which holds in the 
particular model must necessarily be consistent with the system, locally; whether 
or not it is consistent globally is another matter, which requires special attention. 
One property we might notice about the particular model is that it satisfies Lob's 
theorem. By asking, "can this newfound consistent local axiom be made global," 
we might discover Lob's schema. 

More generally, any time we resolve a paradox by the methods of this paper, 
building a particular model, we can look for new consistent local axioms by simply 
examining that particular model; we can then attempt to prove (or disprove) they 
are consistent globally. For example, as seen at the end of Section 4, this kind of 
reasoning lead us to a new variation of the Church-Fitch argument. 

If we find a new globally consistent axiom in this way, it might be a candidate to 
answer Egre's and van Bcnthcm's question. If that axiom somehow explains why a 
stronger system is inconsistent, even better. 

Here are two concrete candidates to answer the question^. First, the schema 
(A™=i ^^(Pi)) V ^(-L) from Section 3. This author initially resolved the surprise 
examination paradox by localizing both K(cf>) — > <j) and /\. =1 ^K{p i ) 1 but this 
was unsatisfactory; but the schema (A™=i "'(f*)) V ^(-L), true in the particular 
model, could be globalized. The resulting system was a "consistent subsystem of the 
conflicting schemata" , and the new schema "provides us with positive information" 
about it. 

Likewise the author initially found the schema o(K(4>)) of Section 4 by looking 
at a specific model witnessing a consistent subsystem of Fitch's hypotheses, and 
o(K((j))) could be argued to provide positive information about that as well. 

Along these same lines, by considering the particular model constructed in Section 
5, we might notice it satisfies (x the lone free variable in <fi) 

(Va# -4 K(4>))) -4 3eMx{(j) ^xe W e ), 



For another possible answer, see Theorem 2 of lFriedmar] (jl975f ). 
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and it's not hard to show this schema can consistently be added to Theorem l5.12.l 
as a global axiom. This schema (an d knowledge thereof) is called an epistemic 
Church's Thesis in iReinhardtl (|l985bl ). 



§7. Conclusion We have shown that certain paradoxes vanish, and certain 
impossibilities become possible, by localizing certain axioms. This should not come 
as too much of a surprise. One might justify necessitation by saying that if we can 
prove 4>, then the knower himself can follow that proof, and therefore knows <fi. But 
for the knower to follow, the proof must only use axioms the knower is aware of. This 
became very clear in Section 2, where paradox occurred despite MyhhTs weakening 
of necessitation: we know by second-order logic that Goodstein's Theorem is true 
in N, but when we don our first-order Peano arithmetist hats, that knowledge lacks 
conviction. Merely adding the troublesome axiom would be harmless (as it is true) , 
but its presence invalidates the justification for the rule of necessitation. 

In most of our examples, we localized soundness, K(ifi) — ¥ <f>. The fact that this 
resolved all those paradoxes gives evidence, in our opinion, that we should take 
greater care before assum ing K(K((j>) — > (j)). For fur ther evidence, co nsider the 
parad ox of the know er of Kaplan fc Montague! (1960) (as described in Anderson 
i|l983t ) or on p. 21 of [EgrJ |2005|)) where K^K{ r <jP) -> ft" 1 ) is one of just three 
schemas (plus arithmetic) which lead to paradox, the other two schemas being 
practically unassailable. And if th a t is n ot already a devastating blow against 

Thomasonl (Il980l) proves that the following system proves 
23 of lEgrel (|2005h ): 



requiring K(K(cf>) 
K( r (j>~ 1 ) for every 



(see p. 



1. K{ r <P) -4 K{ r K ( r n ) n ), 

2. K{ r K( r <P) -> <P), 

3. K{ r (P) if <j) is valid, 

4. K( r <j) -> V n ) -> {K{ r <P) 



Km). 



This shows that (at least for predicate symbols) mere belief in soundness is already 
deadl y- even without sound ness itself! 

See I Alexander! ( preprint ) for several arguments^ for the philosophical plausi- 
bility of knowledge wh ich fails K[K( <f») — »-(/>). I became even further convinced 



of this when I read, in IShapirol (1 19981) . about remarks Godel made at the Gibbs 



lecture dGodell (Il95lh l. The main objection (I think) to admitting the possibility of 
-iK(K(4>) — > <f>) is that truthfulness is built into the very definition of knowledge. 
But in his lecture, Godel distinguished between objective knowledge and subjective 
knowledge, so that, for example, mathematicians might subjectively come to know 
that mathematics is sound, through some argument strictly outside mathematics 
itself- an empirical argument, say. Thus the mathematician might understand, 
subjectively, that K{(f>) — > </> holds for her knowledge, while rejecting K(K{<f)) — > (j)) 
(say, upon considering the second incompleteness theorem), not because of doubting 
the truth of K(<f>) — > cj>, but rather because of doubting the mathematical provability 
of it. 

Section 5 is particularly relevant: epistemological traditions should assume a back 
seat when in conflict with practical applications. A truthful knowing machine which 



7 And sec van Fra asser] (|201lT ) for another argument of the same, when K represents 
belief rather than knowledge. 
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knows its own code could be useful in the real world, even without knowing its own 
truthfulness. We could, perhaps, sidestep the issue by calling such a machine a "be- 
lieving machine" rather than a "knowing machine" , but this would be disingenuous, 
because we know the machine is truthful; to call it a believing machine would be 
to suggest it might be capable of asserting falsities. 

Further Work. One obvious direction to take from here is to expand the list of 
paradoxes treated by glo bal necessitation. One pa rticularly interesting paradox is 
found on pp. 260-261 of Horsten fc Leitgebl ( 200ll ). This paradox can be formally 



treated with the methods of the current paper, but as there are no agents involved 
in it, philosophical justification will require careful treatment in a future paper. 

Having obtained, through global necessitation, consistent variations of certain 
paradoxical systems, one thing to consider is: which of these co nsistent systems can 
be fus ed while preserving consistency? (Compare the work of iFriedman fc Sheard 



(| 19871 ) on axioms about self- referential truth.) For example, by merging ideas from 
the proofs of Theorems 13.6.1 and 14.7.1 it is possible to show that if n > 1 then 
the following system is consistent and does not prove p\ — > K(pi), in a language 
containing operators K, □, and atoms pi, . . . ,p n , thus "simultaneously resolving" 
Fitch's and the Surprise Examination Paradox: 

1. (Global) K((j> V) ~> K{4>) ->• K(ip). 

2. (Global) T n , by which is meant p± V • • • V p n . 

3. (Global) A"=i((^ T i) -> K h T i)), where T i abbreviates pi V • • • Vp 4 . 

4. (Global) (A?=i -^(Pi)) VJf(J-). 

5. (Global) D(cj) -> V) -> (□(<£) -> OWO). 

6. (Local) The strong knowability thesis: o(K ((/>)). 

7. (Local) K(<j>) -> </>. 

8. The rules of global necessitation for K and □. 

Note that in the above system we've localized <>(K((f>)); if we kept it global, the 
same consistency proof would not work (the Preliminary Claims would be hard 
to reconcile). The consistency or inconsistency of the resulting system is presently 
unknown to me (even if o(K ((/>)) were weakened to <j> — > o(K (</)))). 
A similar question can be glossed provocatively: 

Is it possible for a truthful knowing machine to know its own code, 
and simultaneously attend a class in which a surprise examination 
next week is announced? 
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